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Independent Orbiter Assessment 
Analysis of the Rudder/Speed Brake Subsystem 


1 . 0 EXECUTIVE SUMMARY 

The McDonnell Douglas Astronautics Company ( MDAC ) was selected in 
June 1986 to perform an Independent Orbiter Assessment (IOA) of 
the Failure Modes and Effects Analysis (FMEA) and Critical Items 
List (CIL) . Direction was given by the STS Orbiter and GFE 
Projects Office to perform the hardware analysis using the 
instructions and ground rules defined in NSTS 22206 , Instructions 
for Preparation of FMEA and CIL, 10 October 1986 . The IOA 
approach features a top-down analysis of the hardware to 
determine failure modes, criticality, and potential critical 
items. To preserve independence, this analysis was accomplished 
without reliance upon the results contained within the NASA 
FMEA/CIL documentation. This report documents (Appendix C) the 
independent analysis results for the Orbiter Rudder/Speedbrake 
Actuation Mechanism. 

The function of the Rudder/Speedbrake (RSB) is to provide 
directional control and to provide a means of energy control 
during entry. The system consists of two panels on a vertical 
hinge mounted on the aft part of the vertical stabilizer. These 
two panels move together to form a rudder but split apart to make 
a speedbrake. The rudder becomes active at Mach 4.2 and is 
assisted by the Reaction Control System (RCS) yaw jets until Mach 
1.0, where the rudder alone becomes the primary yaw control. 
Between Mach 10 and Mach 4.2 the speedbrake serves to provide 
pitch trim. Between Mach 4.2 and Mach 0.9 the speedbrake is used 
to control drag thus energy dissipation. At touchdown the 
speedbrake is fully opened to provide nose-up pitch movement to 
aid in nose wheel derotation. The Rudder/Speedbrake Actuation 
Mechanism consists of the following elements: 

o Power Drive Unit (PDU) which is composed of a 

hydraulic valve module and a hydraulic motor-powered 
gearbox which contains differentials and mixer gears 
to provide PDU torque output 
o Four geared rotary actuators which apply the PDU 
generated torque to the rudder/speedbrake panels 
o Ten torque shafts which join the PDU to the rotary 

actuators and interconnect the four rotary actuators 

The IOA analysis process utilized available actuator schematics, 
limited detailed hardware drawings, and sketches which were 
reviewed with the subsystem manager. From this information the 
hardware assemblies and components were defined. Each level of 
hardware was evaluated and analyzed for possible failures and 
causes. Criticality was assigned based upon the severity of the 
effect for each failure mode. 
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Figures 1, 2 and 3 present a summary of the failure criticalities 
for each of the major elements of the RSB Servoactuator . A 
summary of the number of failure modes by criticality is 
presented below with Hardware (HW) criticality first and 
Functional (F) criticality second. 


+ + 

| Summary of IOA Failure Modes By Criticality (HW/F) j 


Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

3/3 

TOTAL 

Number : 

12 

13 

- 

4 

- 

9 

38 


For each failure mode identified, the criticality and redundancy 
screens were examined to identify critical items . A summary of 
Potential Critical Items (PCIs) is presented as follows. 


+ + 

j Summary of IOA Potential Critical Items (HW/F) j 


Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

TOTAL 

Number : 

h 

12 

13 

- 

2 

- 

27 


Critical RSB failures which result in potential loss of vehicle 
control were mainly due to loss of hydraulic fluid, fluid 
contaminators , and mechanical failures in gears and shafts. 
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RSB ANALYSIS SUMMARY 



Figure 1 - RSB ACTUATOR SUBSYSTEM 
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2 . 0 INTRODUCTION 


2.1 Purpose 

The 51-L Challenger accident prompted the NASA to readdress 
safety policies, concepts, and rationale being used in the 
National Space Transportation System (NSTS). The NSTS Office has 
undertaken the task of reevaluating the FMEA/CIL for the Space 
Shuttle design. The MDAC is providing the independent assessment 
of the Orbiter FMEA/CIL for completeness and technical accuracy. 


2 . 2 Scope 

The scope of the independent FMEA/CIL assessment activity 
encompasses those Shuttle Orbiter subsystems and GFE hardware 
identified in the Space Shuttle Independent FMEA/CIL Assessment 
Contractor Statement of Work. Each subsystem analysis addresses 
hardware, functions, internal and external interfaces, and 
operational requirements for all mission phases. 


2.3 Analysis Approach 

The independent analysis approach is a top-down analysis 
utilizing as-built drawings to breakdown the respective subsystem 
into components and low-level hardware items. Each hardware item 
is evaluated for failure mode, effects, and criticality. These 
data are documented in the respective subsystem analysis report, 
and are used to assess the NASA and Prime Contractor FMEA/CIL 
reevaluation results. The IOA analysis approach is summarized in 
the following Steps 1.0 through 3.0. Step 4.0 summarizes the 
assessment of the NASA and Prime Contractor FMEAs/CILs that is 
performed and documented at a later date. 

Step 1.0 Subsystem Familiarization 

1 . 1 Define subsystem functions 

1.2 Define subsystem components 

1.3 Define subsystem specific ground rules and 

assumptions 

Step 2.0 Define subsystem analysis diagram 

2.1 Define subsystem 

2.2 Define major assemblies 

2 . 3 Develop detailed subsystem representations 


Step 3.0 Failure events definition 

3 . 1 Construct matrix of failure modes 

3 . 2 Document IOA analysis results 
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Step 4.0 Compare IOA analysis data to NASA FMEA/CIL 

4.1 Resolve differences 

4.2 Review in-house 

4 . 3 Document assessment issues 

4.4 Forward findings to Project Manager 


2.4 Rudder/Speedbrake Ground Rules and Assumptions 

The RSB ground rules, and assumptions used in this IOA are 
defined in Appendix B.l and B.2. There were no subsystem 
specific ground rules and assumptions used in this analysis. 


3 . 0 SUBSYSTEM DESCRIPTION 

3.1 Design and Function 

The Rudder/Speedbrake Actuation Subsys tem consi sts of that 
hardware required to provide both directional and energy control 
of the Orbiter during entry. The RSB subsystem consists of the 
following components. 

1. A PDU is made up of two halves which are identical in 
makeup and operation: one for rudder and one for 
speedbrake. A switching valve determines which of the 
three Orbiter hydraulic systems supplies the PDU 
electro-hydraulic Servo VLV (E-H Servo VLV) . There are 
eight E-H Servo VLVs: four in each PDU half. Each half 
of the PDU is controlled by four E-H Servo VLVs which 
receive commands from four Aerosurface Amplifiers/Flight 
Control System (ASA/FCS) channels. 

Each E-H Servo VLV receives from its ASA a position 
error command which it changes to a hydraulic pressure 
command. This is ported to a triplex power valve where 
the pressure (secondary Delta P) along with pressures 
from the three other E-H Servo VLVs command two valves 
that control pressure to three hydraulic motor/brake 
assemblies. These motors are used to drive a 
differential gearbox which sums all three motor torques 
and outputs it to a single drive shaft. The shaft is 
connected to a mixer gearbox. The mixer gearbox takes 
the drive shaft inputs from both the rudder and 
speedbrake channels, mixes them, and outputs them to a 
set of four rotary actuators which move the vertical 
panels. When the output shafts rotate in the same 
direction, the two panels move in the same direction 
thus providing rudder control, when the output shafts 
rotate in the opposite direction, the two panels move in 
opposite direction thus acting as a speedbrake. 

For each E-H Servo VLV there is an isolation valve which 
will isolate a failed E-H Servo VLV when its secondary 
delta P fails the ASA fault detection limits. The 
isolation valve can be commanded from the ASA, a crew 
keyboard input or an FCS switch taken to off. The crew 
can also inhibit an ASA isolation valve command by 
placing a FCS switch in the ORIDE position. If a 
problem develops within an E-H Servo VLV or its 
commanded position is different than the others, 
secondary delta P should begin to rise. Each channel 
has a secondary delta P transducer (LVDT) which sends 
Delta P to the ASA. Once the ASA detects secondary 
delta P at or above 2200 PSI for more than 120 msec, it 
will send an isolation command to the appropriate 
isolation valve which bypasses hydraulic pressure to the 
E-H Servo VLV causing Its commanded pressure to the 
power spool to drop to zero. 
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Position from the Rotary Variable Differential 
Transformer (RVDT) on the differential gearbox are sent 
to the ASA and to the crew displays. Position is not 
used by the ASA for failure detection; it is used only 
to modify (negative feedback) the position command 
generated by the General Purpose Computer (GPC) . The 
following is a list of the components of the PDU which 
were reviewed and analyzed for failure modes . 


a. 

b. 

c. 

d. 

e. 

f. 

g- 

h. 

i. 

J. 

k. 


Switching Valve 

Standby Hydraulic Circulation Valve 
E-H Servo VLV 
E-H Servo VLV Filter 
Bypass Valve 

Secondary Delta P Transducer 
Triplex Power Valve 
Hydraulic Motor/Brake Assembly 
Differential Gearbox 
Position Transducer 
Mixer Gearbox 


2. There are four geared rotary actuators which drive the 
two aerosurface panels. Commands from the PDU mixer 
gearbox are transmitted via two shaft outputs to the two 
columns of aluminum drive shafts connecting the four 
rotary actuators. Internal gears pick up the drive 
shaft inputs and move the brackets that contain the 
aerosurface fastening points. The Orbiter fastening 
points are fixed, attached to Orbiter structure. Each 
rotary actuator is made up of two driver gear 
assemblies, a series of satellite gear assemblies, and 
two center drum assemblies which drive independently of 
each other. Driveshaft rotations in the same direction 
will turn the center drums and therefore the aerosurface 
fastening in the same direction (rudder control). 
Driveshaft rotations in the opposite directions drive 
the center drums in opposite directions (speedbrake 
control ) . 


3 . 2 Interfaces and Locations 

The RSB interfaces with the four ASAs which receive commands via 
four FA MDM's from the four GPCs. Crew initiated inputs; Rudder 
Pedal Transducer Assembly (RPTA) , Speedbrake Translation 
Controller (SBTC), and Rotation Hand Controller (RHC), are 
inputed to the GPCs. The crew can turn power on or off to any 
ASA channel, can place a FCS channel switch in ORIDE which 
bypasses the ASA fault detection circuitry, and send bypass 
inhibit commands to the ASA via keyboard entry. 


The RSB actuation mechanism is physically located in the vertical 
stabilizer. The ASAs which provide position commands to the 
actuators are located in avionics bays 4, 5, and 6. The Surface 
Position Indicator (SPI) provides a gauge type display for the 
crew to check aerosurface position. It is located between 
Cathode Ray Tubes (CRTs) 1 and 2 on panel F7. The following CRT 
displays are available to the crew: GNC System Summary 1 (PASS 
and BFS) , Spec 53 Entry Control Display, FCS Dedicated Display 
Checkout (during OPS 8) and the Caution and Warning (Panel F7) 
(FCS Saturation, FCS Channel and Backup C/W Alarm). The two sets 
of switches which provide crew inputs to the actuator ASA system 
are the FCS channel monitor switches on Panel C-3 and the ASA 
power switches on Panels 014, 015, and 016. 


3 . 3 Hierarchy 

Figure 4 shows the RSB PDU block diagram. Figures 5 through 9 
show individual components which were analyzed for failure modes. 


HYD. SYS. 
1 2 3 



Figure 4 - RSB PDU BLOCK DIAGRAM 
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Figure 6 - SWITCHING VALVE 
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Pp primary pressure p s| standby one press P$2 standby two press 

Rp primary return R$| standby one return Rjj standby two return 






Figure 7 - MECHANICAL DRIVE 
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Figure 9 - RSB ROTARY ACTUATOR CUT-AWAY 
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4 . 0 ANALYSIS RESULTS 

Detailed analysis results for each of the identified failure 
modes are presented in Appendix C. Table I presents a summary of 
the criticalities for the PDU, the components which make up the 
PDU, the rotary actuators, and the interconnect drive shafts. 


b 

Criticality 

(HDW/FUNC) 

— 

-1 

1/1 

— 

2/1R 

j 

2/2 

— 

3/1R 

3/2R 

— 

3/3 

b 

Total 

L 

1 

b ^ 

b H 

b H 

b H 

* — — — — — — — 


o PDU 

PDU Elements 
SwTEching vlv 
R ecirculation VLV 
E-H Servo vlv 
B ypass VLV 

E-H Servo VLV Filter 
Secondary Delta P 
Transducer 
Triplex Power VLV 
Hydraulic Motor/ 
Brake 

Differential Gearbox 
Position Transducer 
Mixer Gearbox 
O ROTARY ACTUATOR 
o DRIVE SHAFT 


2 

3 

1 

1 

1 

1 


2 

2 

5 


1 

1 

1 


2 

1 


+ + + + 

| Total | 12 | 13 | - 

+ + + + — 


I 

-+— 


--- 1 


2 4 

2 2 

5 
1 
2 

1 
1 

5 
5 
2 
1 
1 
1 

■+ + + 

| 9 | 38 | 

- + + + 
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Of the 38 failure modes analyzed, 27 failures were determined to 
be PCIs. A summary of PCls is presented in Table II. Appendix D 
presents a cross reference between each PCI and a specific work- 
sheet in Appendix C. 


+ 

I TABLE II Summary of IOA Potential Critical Items i 


Criticality: 

l/l 

2/1R 

2/2 

3/1R 

3/2R 

TOTAL 

PDU 

10 

13 

— 

2 

- 

25 

Rotary Actuator 

1 

- 

- 

- 

- 

1 

Drive Shaft 

1 





1 

i Total 

1 12 1 

1 13 | 


1 2 1 

1 - ! 

27 


+ + + + + + + — + 


4.1 Analysis Results - Power Drive Unit 

Failures which were related to the PDU as an entity were first 
analyzed. Critical failures were due to loss of hydraulic fluid, 
gross and slow leaks , and mechanical failures . Noncritical 
failures involved redundant heater blankets: a failure of non- 
functionally critical components. 

Components which make up the PDU were individually analyzed. 

Most critical failures of these components included loss of 
command signal input, valve failure due to contamination, filter 
clogged, loss of hydraulic pressure, mechanical failures in gears 
and shafts, and inability to detect failures by the ASA fault 
detection circuitry. 


4.2 Analysis Results - Rotary Actuator 

Analysis of the actuator indicated that either an open or a jam 
in any of the gear trains resulted in loss of the actuator. Loss 
of the actuator would result in overloading the other actuators 
which would cause loss of vehicle control. 


4.3 Analysis Results - Drive Shafts 

Critical failures of the drive shaft, shaft fracture, and/or gear 
shearing from the shaft, result in loss of drive to or between 
the four rotary actuators which results in loss of vehicle 
control . 
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APPENDIX A 
ACRONYMS 


ASA 

BFS 

C&W 

CIL 

CRT 

delta P 

E-H Servo VLV 

F 

FA 

FCS 

FMEA 

GNC 

GRT 

HW 

IOA 

LVDT 

MDAC 

MDM 

OMRSD 

OPS 

ORIDE 

PASS 

PDU 

RI 

RPTA 

RHC 

RSB 

RVDT 

SBTC 

SPI 

VLV 


Aerosurface Amplifier 
Backup Flight System 
Caution and Warning 
Critical Items List 
Cathode Ray Tube 
Differential Pressure 
Electro-Hydraulic Servovalve 
Functional 
Flight Aft 

Flight Control System 
Failure Modes Effects Analysis 
Guidance Navigation and Control 
General Purpose Computer 
Hardware 

Independent Orbiter Assessment 
Linear Variable Differential Transducer 
McDonnell Douglas Astronautics Company 
Multiplexer /Demultiplexer 
Operational Maintenance Requirements and 
Specifications Document 
Operational Sequence 
Override 

Primary Avionics Software System 
Power Drive Unit 
Rockwell International 
Rudder Pedal Transducer Assembly 
Rotation Hand Controller 
Rudder Speedbrake 

Rotating Variable Differential Transducer 
Speedbrake Translation Controller 
Surface Position Indicator 
Valve 
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APPENDIX B 


DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B.l Definitions 

B.2 Project Level Ground Rules and Assumptions 
B.3 Subsystem-Specific Ground Rules and Assumptions 
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APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B.l Definitions 

Definitions contained in NSTS 22206 , Instructions For Preparation 
of FMEA/CIL , 10 October 1986 , were used with the following 
amplifications and additions . 

INTACT ABORT DEFINITIONS : 

RTLS - begins at transition to OPS 6 and ends at transition 
to OPS 9, post-flight 

TAL - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

AOA - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

ATO - begins at declaration of the abort and ends at 
transition to OPS 9 , post-flight 

CREDIBLE ( CAUSE ) - an event that can be predicted or expected in 
anticipated operational environmental conditions. Excludes an 
event where multiple failures must first occur to result in 
environmental extremes 

CONTINGENCY CREW PROCEDURES - procedures that are utilized beyond 
the standard malfunction procedures, pocket checklists, and cue 
cards 

EARLY MISSION TERMINATION - termination of onorbit phase prior to 
planned end of mission 

EFFECTS /RATIONALE - description of the case which generated the 
highest criticality 

HIGHEST CRITICALITY - the highest functional criticality 
determined in the phase-by-phase analysis 

MAJOR MODE (MM) - major sub-mode of software operational sequence 
(OPS) 

MC - Memory Configuration of Primary Avionics Software System 
( PASS ) 

MISSION - assigned performance of a specific Orbiter flight with 
payload/obj ective accomplishments including orbit phasing and 
altitude (excludes secondary payloads such as GAS cans, 
middeck P/L, etc.) 
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MULTIPLE ORDER FAILURE - describes the failure due to a single 
cause or event of all units which perform a necessary (critical) 
function 

OFF-NOMINAL CREW PROCEDURES - procedures that are utilized beyond 
the standard malfunction procedures, pocket checklists, and cue 
cards 

OPS - software operational sequence 

PRIMARY MISSION OBJECTIVES - worst case primary mission objec- 
tives are equal to mission objectives 

PHASE DEFINITIONS : 

PRELAUNCH PHASE - begins at launch count-down Orbiter 
power-up and ends at moding to OPS Major Mode 102 (liftoff) 

LIFTOFF MISSION PHASE - begins at SRB ignition (MM 102) and 
ends at transition out of OPS 1 (Synonymous with ASCENT) 

ONORBIT PHASE - begins at transition to OPS 2 or OPS 8 and 
ends at transition out of OPS 2 or OPS 8 

DEORBIT PHASE - begins at transition to OPS Major Mode 
301 and ends at first main landing gear touchdown 

LANDING/ SAFING PHASE - begins at first main gear 
touchdown and ends with the completion of post-landing 
safing operations 
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APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B . 2 IOA Project Level Ground Rules and Assumptions 

The philosophy embodied in NSTS 22206, Instructions for 
Preparation of FMEA/CIL , 10 October 1986 , was employed with the 
following amplifications and additions. 


1 . The operational flight software is an accurate 
implementation of the Flight System Software Requirements 
(FSSRs ) . 

RATIONALE: Software verification is out-of-scope of 
this task. 

2. After liftoff, any parameter which is monitored by system 
management (SM) or which drives any part of the Caution and 
Warning System (C&W) will support passage of Redundancy 
Screen B for its corresponding hardware item. 

RATIONALE: Analysis of on-board parameter availability 
and/or the actual monitoring by the crew 
is beyond the scope of this task. 

3. Any data employed with flight software is assumed to be 
functional for the specific vehicle and specific mission 
being flown. 

RATIONALE: Mission data verification is out-of-scope of 
this task. 

4. All hardware (including firmware) is manufactured and 
assembled to the design specifications/drawings. 

RATIONALE: Acceptance and verification testing is 

designed to detect and identify problems 
before the item is approved for use. 

5. All Flight Data File crew procedures will be assumed 
performed as written, and will not include human error in 
their performance. 

RATIONALE: Failures caused by human operational error 
are out-of-scope of this task. 
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All hardware analyses will, as a minimum, be performed at 
the level of analysis existent within NASA/Prime Contractor 
Orbiter FMEA/CILs , and will be permitted to go to greater 
hardware detail levels but not lesser. 

RATIONALE: Comparison of IOA analysis results with 

other analyses requires that both analyses 
be performed to a comparable level of 
detail . 

Verification that a telemetry parameter is actually 
monitored during AOS by ground-based personnel is not 
required . 

RATIONALE: Analysis of mission-dependent telemetry 

availability and/or the actual monitoring of 
applicable data by ground-based personnel is 
beyond the scope of this task. 

The determination of criticalities per phase is based on the 
worst case effect of a failure for the phase being analyzed. 
The failure can occur in the phase being analyzed or in 
any previous phase, whichever produces the worst case 
effects for the phase of interest. 

RATIONALE: Assigning phase criticalities ensures a 
thorough and complete analysis. 

Analysis of wire harnesses, cables and electrical connectors 
to determine if FMEAs are warranted will not be performed 
nor FMEAs assessed. 

RATIONALE: Analysis was substantially complete prior 

to NSTS 22206 ground rule redirection. 

Analysis of welds or brazed joints that cannot be inspected 
will not be performed nor FMEAs assessed. 

RATIONALE: Analysis was substantially complete prior 

to NSTS 22206 ground rule redirection. 

Emergency system or hardware will include burst discs and 
will exclude the EMU Secondary Oxygen Pack (SOP), pressure 
relief valves and the landing gear pyrotechnics. 

RATIONALE: Clarify definition of emergency systems to 
ensure consistency throughout IOA project. 


APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B.3 RSB Specific Ground Rules and Assumptions 


None. 


APPENDIX C 
DETAILED ANALYSIS 


This section contains the IOA analysis worksheets generated 
during the analysis of this subsystem. The information on these 
worksheets is intentionally similar to the NASA FMEAs. Each of 
these sheets identifies the hardware item being analyzed, and 
parent assembly, as well as the function. For each failure mode, 
the possible causes are outlined, and the assessed hardware and 
functional criticality for each mission phase is listed, as 
described in the NSTS 22206, Instructions for Pre par ation of FMEA 
and CIL, 10 October 1986. Finally, effects are entered at the 
bottom of each sheet , and the worst case criticality is entered 
at the top. 


LEGEND FOR IOA ANALYSIS WORKSHEETS 


Hardware Criticalities: 

1 - Loss of life or vehicle 

2 « Loss of mission or next failure of any redundant item 

{like or unlike) could cause loss of life/vehicle 

3 = All others 

Functional Criticalities: 

1R = Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of life or vehicle. 

2R - Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of mission. 

Redundancy Screen A: 

1 - Is Checked Out PreFlight 

2 - Is Capable of Check Out PreFlight 

3 = Not Capable of Check Out PreFlight 
NA - Not Applicable 

Redundancy Screens B and C: 

P = Passed Screen 
F = Failed Screen 
NA = Not Applicable 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

101 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: POWER DRIVE UNIT (PDU) 

FAILURE MODE: GROSS FLUID LOSS (3 SYSTEMS) BETWEEN SWITCH VALVE 

AND POWER VALVE MODULES 


LEAD ANALYST: R. WILSON 

BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


FLIGHT PHASE 
PRE LAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 

REDUNDANCY SCREENS: 


SUBSYS LEAD: R. WILSON 


CRITICALITIES 


HDW/FUNC 

ABORT 

HDW/FUNC 

3/3 

RTLS: 

1/1 

3/3 

TAL: 

1/1 

3/3 

AO A: 

1/1 

1/1 

3/3 

ATO: 

1/1 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: 
PART NUMBER: 


VERTICAL STABILIZER 
MC621-0053-0048 


CAUSES: COMPLETE SEAL FAILURE OR RUPTURE OF SERVO VALVE BODY, 

ISOLATION VALVE BODY, AP TRANSDUCER BODY, MANIFOLD LINES, RETURN 
LINES 

EFFECTS/RATIONALE: 

LOSS OF HYDRAULIC FLUID TO DRIVE HYDRAULIC MOTORS, RESULTS IN 
LOSS OF POWER TO DRIVE ROTARY ACTUATORS. THIS CAUSES LOSS OF 
CONTROL, AND . 

LOSS OF CREW/VEHICLE. 


REFERENCES : 


C-2 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

102 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: POWER DRIVE UNIT (PDU) 

FAILURE MODE: GROSS HYDRAULIC FLUID LOSS (1 SYSTEM) 


LEAD ANALYST: R. WILSON 


SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

3/3 

AOA: 

2/1R 

DEORBIT: 

LANDING/SAFING: 

2/1R 

3/3 

ATO: 

2/1R 

REDUNDANCY SCREENS: 

A [NA ] 

B [ F I 

C [ P ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: HYDRAULIC LINE TO MOTOR RUPTURE, IMPROPERLY SWAGED 

JOINTS 


EFFECTS/RATIONALE : 

LOSS OF ONE OF THREE REDUNDANT HYDRAULIC MOTOR DRIVES. HYRAULIC 
MOTOR BRAKE IS SET ON LOSS OF PRESSURE WHICH LOCKS SHAFT TO 
SUMMER DIFFERENTIAL GEAR BOX PREVENTING BACKDRIVE OF OTHER TWO 
MOTORS. WORST CASE EFFECT IS LOSS OF HOLDING TORQUE FROM THE 
MOTOR/BRAKE. OTHER TWO MOTORS WILL BACKDRIVE IF BRAKE DOES NOT 
SET (THIS IS CONSIDERED TO BE A SMART FAILURE). 

REFERENCES : 


C-3 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

103 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: POWER DRIVE UNIT (PDU) 

FAILURE MODE: INTERNAL LEAK 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 

BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

3/3 

AO A: 

2/1R 

DEORBIT: 

LANDING/SAFING: 

2/1R 

3/3 

ATO: 

2/1R 

REDUNDANCY SCREENS: 

A [ 3 ] 

B [ F ] 

c [ p ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: SEAL FAILURE SWITCH VALVE SPOOL/SLEEVE, SW VALVE MODULE, 

STRUCTURAL JOINTS. 


EFFECTS/RATIONALE : 

ABORT DECISION. THERE IS A POSSIBLE LOSS OF ONE HYDRAULIC SYSTEM 
OVER AN EXTENDED PERIOD OF TIME. HOWEVER, THERE IS ADEQUATE = 
POWER FROM THE REMAINING TWO HYDRAULIC SYSTEMS TO DRIVE THE 
ACTUATORS . 


REFERENCES : 


C-4 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

104 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: FILTER 

FAILURE MODE: FAILS TO FILTER 


LEAD ANALYST: R. WILSON 


SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) FILTER (2/1R CHANNEL, 

4) 

5) 

6) 

7) 

8 ) 

9) 


1 SB CHANNEL) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

“ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL:. 

3/3 

ONORBIT: 

3/3 

AOA: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: RUPTURED FILTER 

EFFECTS/RATIONALE : 

NONE. THE 15 MICRON FILTER IS SIZED FOR VEHICLE LIFE. THIS IS 
CONSIRERED TO BE A NONCREDIBLE FAILURE SINCE NO KNOWN CAUSES 
COULD RUPTURE THE FILTER WHICH IS RATED AT 4500-PSI. 


REFERENCES : 


C-5 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

10/16/86 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

RSB 

FLIGHT: 

1/1 

MDAC ID: 

105 

ABORT: 

1/1 

ITEM: 

FILTER 



FAILURE MODE 

: NO FLOW TO 

SERVOVALVE 


LEAD ANALYST 

': R. WILSON 

SUBSYS LEAD: R. WILSON 



BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (I) 

3) FILTER (2/1R CHANNEL, 1 SB CHANNEL) 

4 ) 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

3/3 

AOA: 

1/1 

DEORBIT: 

1/1 

ATO: 

1/1 

LANDING/S AFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: CLOGGED 

EFFECTS/RATIONALE : 

FAILURE CAUSES LOSS OF HYDRAULIC PRESSURE NECESSARY TO DRIVE 
SERVOVALVES. THIS RESULTS IN LOSS OF RSB CONTROL THEREBY 
RESULTING IN LOSS OF VEHICLE/ CREW. 


REFERENCES : 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

106 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: HEATER BLANKET 

FAILURE MODE: LOW TEMPERATURE SW. CLOSED (FAIL TO OPEN) 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) HEATER BLANKET 

4) 

5) 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AOA: 

3/3 

DEORBIT: 
LANDING/ SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: CONTAMINATION, CONTACTS RUSTED TOGETHER, PIECE PART 

FAILURE 

EFFECTS/RATIONALE : 

NONE -OVERTEMP (HIGH) BREAKS CIRCUIT. REDUNDANT HEATERS -ONE 
HEATER IS ADEQUATE. 


REFERENCES : 


C-7 


INDEPENDENT ORBITER ASSESSMENT 


ORBITER SUBSYSTEM 

ANALYSIS WORKSHEET 



DATE: 10/16/86 

HIGHEST CRITICALITY 

HDW/FUNC 


SUBSYSTEM: RSB 

FLIGHT: 

3/3 


MDAC ID: 107 

ABORT: 

3/3 


ITEM: HEATER BLANKET 



B 

FAILURE MODE: OVER TEMP. SW. 

CLOSED (FAILS TO OPEN) 



LEAD ANALYST: R. WILSON 

SUBSYS LEAD: R. WILSON 

.... 


BREAKDOWN HIERARCHY: 




1) RSB SERVO ACTUATORS 




2) PDU (1) 



m 

3) HEATER BLANKET 




4) 



— 

5) 



gj 

6) 




7) 




8) 





9) 



— 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

m 

PRELAUNCH: 

3/3 

RTLS: 

3/3 


LIFTOFF: 

3/3 

TAL: 

3/3 


ONORBIT: 

3/3 

AO A: 

3/3 


DEORBIT: 

3/3 

ATO: 

3/3 


LANDING/SAFING: 

3/3 




REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 



LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: CONTAMINATION, CONTACTS RUSTED TOGETHER, PIECE PART 

FAILURE 

EFFECTS/RATIONALE : 

NONE-THREE TEMPERATURE SENSORS WILL VERIFY ACTUAL OVERTEMP 
SHOULD TEMP. EXCEED LIMIT, POWER CAN BE REMOVED FROM FAULTY 
CIRCUIT. ONE HEATER IS ADEQUATE. 


REFERENCES : 


C-8 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

108 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

3/3 

3/3 


ITEM: HEATER BLANKET 

FAILURE MODE: OPEN (FAILS TO ENERGIZE) LOW TEMP SW., HIGH TEMP 

SW., BLANKET HEATER ELEMENT 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) HEATER BLANKET 

4) 

5) 

6 ) 

7 ) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AOA: 

3/3 

DEORBIT: 
LANDING/S AFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: OPEN LEADS, BROKEN HEATER ELEMENT 

EFFECTS/RATIONALE : 

NONE-CIRCUIT A & CIRCUIT B ARE INDEPENDENT. ONE HEATER IS 
ADEQUATE . 


REFERENCES : 


C-9 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

109 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: HEATER BLANKET 

FAILURE MODE: TEMP SENSOR ERRONEOUS READING 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) HEATER BLANKET 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 
LANDING/S AFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: OPEN BROKEN WIRE ELEMENT, SHORT IN SENSING ELEMENT 


EFFECTS/RATIONALE : 

LOSS OF SENSING UNIT ONLY. HEATERS CONTINUE TO OPERATE. DATA IS 
USED FOR DISPLAY ONLY. 


REFERENCES : 


C-10 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

110 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: SWITCH VALVE 

FAILURE MODE: SECONDARY VALVE FAILS TO SWITCH 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) SWITCH VALVE 

4 ) 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

3/3 

AOA: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P ] 

c [ P ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: JAMMED TRANSFER SPOOL, CONTAMINATION 


EFFECTS/RATIONALE : 

WORST CASE FAILURE IS FAILURE OF SECOND SPOOL TO TRANSFER FROM 
2ND STANDBY (PS2) HYDRAULIC SOURCE. SUBSEQUENT FAILURE OF PS2 
RESULTS IN LOSS OF RSB CONTROL AND POTENTIAL LOSS OF 
CREW/ VEHICLE . 


REFERENCES : 


C-ll 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

111 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: SWITCH VALVE 

FAILURE MODE: 1ST VALVE FAILS TO SWITCH ON LOSS OF PRIMARY HYD. 

SUPPLY 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 

BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) SWITCH VALVE 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

3/3 

AOA: 

2/1R 

DEORBIT: 

3/3 

ATO: 

2/1R 

LANDING/SAFING: 

2/1R 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P ] 

C [ P ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: JAMMED TRANSFER SPOOL, CONTAMINATION 

EFFECTS/RATIONALE : 

NONE. THE SECOND VALVE WHICH IS TIED TO PS-2 WILL SWITCH TO 
PROVIDE HYRAULIC PRESSURE TO THE SEROVALVES. HOWEVER A 
SUBSEQUENT LOSS OF PS-2 WILL RESULT IN LOSS OF RSB CONTROL. 


REFERENCES 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

112 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: SWITCH VALVE 

FAILURE MODE: NO OUTPUT FLOW ACTIVE STAGE 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 

BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) SWITCH VALVE 

4) 

5) 

6) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/3 

TAL: 

3/1R 

ONORBIT: 

3/3 

AOA: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P ] 

C [ P ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: LOSS OF ASSOCIATED HYRAULIC PRESSURE Pp, PS1 OR PS 2 

EFFECTS/RATIONALE : 

NONE. VALVE SWITCHES TO ONE OF THE TWO REMAINING HYDRAULIC 
SYSTEMS . 


REFERENCES 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

113 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: SWITCH VALVE 

FAILURE MODE: VALVE POSITION TRANSDUCER FAILURE 


LEAD ANALYST: R. WILSON 


SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) SWITCH VALVE 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: LV DTj- BROKEN /SHORTED ELECTRICAL LEAD 

EFFECTS/RATIONALE : 

INSTRUMENT LIGHT SHOWS TRANSFER OF HYDRAULIC SYSTEM. LIGHT IS 
INDICATION OF VALVE POSITION ONLY AND HAS NO EFFECT ON THE SERVO 
SYSTEM. A SECOND FAILURE IS REQUIRED BEFORE SWITCHING TO ANOTHER 
HYDRAULIC SOURCE. 


REFERENCES : 


C-14 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

114 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

2/1R 

2/1R 


ITEM: HYDRAULIC VALVE 

FAILURE MODE: FAILS AT NULL OR OSCILLATORY (UNDETECTED BY ASA) 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 

BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) ELECTRO HYDRAULIC SERVOVALVE ASSEMBLY 

4) HYRAULIC VALVE (4R, 4SB) 

5) 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

3/3 

AOA: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: JAMMED SPOOL (CONTAMINATION) , LOSS OF OF SIGNAL TO 

TORQUE MOTOR, TORQUE MOTOR FAILS 

EFFECTS/RATIONALE : 

NONE. LOSS OF 1 OF 4 CHANNELS (RUDDER AND/OR SPEEDBRAKE) . THERE 
IS A POSSIBLE LOSS OF CONTROL AFTER LOSS OF ANOTHER CHANNEL. THE 
ASA CANNOT FAULT ISOLATE REMAINING CHANNELS IF ANOTHER FAILURE 
OCCURS. 


REFERENCES : 


C-15 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

115 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: HYDRAULIC VALVE 

FAILURE MODE: FAILS TO RETURN TO NULL 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 

BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) ELECTRO HYDRAULIC SERVOVALVE ASSEMBLY 

4) HYRAULIC VALVE (4R, 4SB) 

5) 

6 ) 

7) 

8 ) 

9 ) 


CRITICA LITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

3/3 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P ] 

C [ P ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: JAMMED SPOOL (CONTAMINATION), LOSS OF OF SIGNAL TO 

TORQUE MOTOR," TORQUE MOTOR FAILS 

EFFECTS/RATIONALE: 

LOSS OF 1 OF 4 CHANNELS (RUDDER AND/OR SPEEDBRAKE) . THERE IS A 
POSSIBLE LOSS OF CONTROL AFTER LOSS OF ANOTHER CHANNEL. THE ASA 
CANNOT FAULT ISOLATE 2 REMAINING CHANNELS IF ANOTHER FAILURE 
OCCURS . 


REFERENCES : 


C-16 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 10/16/86 

SUBSYSTEM: RSB 

MDAC ID: 116 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

2/1R 

2/1R 


ITEM: HYDRAULIC VALVE 

FAILURE MODE: NO OR ERRONEOUS OUTPUT TO POWER VALVE 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) ELECTRO HYDRAULIC SERVOVALVE ASSEMBLY 

4) HYRAULIC VALVE (4R, 4SB) 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

3/3 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/ SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: FAULT DETECTION TRANSDUCER OPEN, OR SHORT CIRCUIT 

ELECTRICAL OPEN IN ASA, MOTOR FLAPPER BROKEN. 

EFFECTS/RATIONALE : 

NONE. LOSS OF 1 OF 4 CHANNLES. THE HARDWARE FAILURE MODE IS 
3/1R, HOWEVER THE ASA FAILURE MODE IS 2/1R. TWO ASA FAILURES CAN 
CAUSE LOSS OF CONTROL IF DETECTED. THE ASA CANNOT FAULT ISOLATE 
REMAINING CHANNELS IF ONE FAILS. 


REFERENCES 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

117 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: TORQUE MOTOR ASSEMBLY 

FAILURE MODE: MOTOR FAILS 


LEAD ANALYST: R. WILSON 


SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) ELECTRO HYDRAULIC SERVOVALVE ASSEMBLY 

4) TORQUE MOTOR ASSEMBLY (4R, 4SB) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

3/3 

AOA: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/ SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: OPEN/SHORT IN MOTOR WINDINGS, LOSS OF SIGNAL FROM ASA. 

EFFECTS/RATIONALE : 

NONE. LOSS OF 1 OF 4 CHANNELS (RUDDER OR SPEEDBRAKE) . THE 
HARDWARE FAILURE MODE IS 3/1R. TWO ASA FAILURES CAN CAUSE LOSS 
OF CONTROL IF UNDETECTED. ASA FAILURE MODE IS 2/1R SINCE ASA 
CANNOT FAULT ISOLATE REMAINING CHANNELS IF ONE FAILS. 

(SEE MDAC ID. 114) 

REFERENCES : 


C-18 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

118 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: TORQUE HOTOR ASSEMBLY 

FAILURE MODE: FLAPPER FAILS TO CLOSE OFF ORIFICE TO DIRECT HYD. 

PRESSURE TO SERVOVALVE 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) ELECTRO HYDRAULIC SERVOVALVE ASSEMBLY 

4) TORQUE MOTOR ASSEMBLY (4R, 4SB) 

5) 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 



FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 


PRELAUNCH: 

3/3 

RTLS: 

2/1R 


LIFTOFF: 

3/3 

TAL: 

2/1R 

*■ 

ONORBIT: 

3/3 

AO A: 

2/1R 


DEORBIT: 

2/1R 

ATO: 

2/1R 


LANDING/SAFING: 

3/3 




REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: FLAPPER BROKEN, FATIGUE 

EFFECTS/RATIONALE : 

LOSS OF 1 OF 4 CHANNELS (RUDDER OR SPEEDBRAKE). SEE MDAC ID. 116 


REFERENCES : 


fc i 



i r~i 


C-19 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

119 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: SECONDARY DELTA P TRANSDUCER (4R, 4SB) 

FAILURE MODE: LOSS OR ERRONEOUS OUTPUT (1 OF 4 OUTPUTS FROM R OR 

SB) 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) ELECTRO HYDRAULIC SERVOVALVE ASSEMBLY 

4) SECONDARY DELTA P TRANSDUCER 

5) 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

3/3 

AOA: 

2/1R 

DEORBIT: 

1/R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: OPEN COIL OR LEAD; FAULTY TRANSDUCER, DRIFT, ELECTRICAL 

SHORT, OPEN IN ASA. 

EFFECTS/RATIONALE: . _ .... 

LOSS OF 1 OF 4 CHAlMtJi. THE HARDWARE FAILURE ftODE IS 3/1R. TWO 
ASA FAILURES CAN CAUSE LOSS OF CONTROL IF UNDECTED. ASA FAILURE 
MODE IS 2/1R. ASA CANNOT FAULT ISOLATE LAST CHANNELS IF ONE 
FAILS. 


REFERENCES 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

120 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

3/1R 

3/1R 


ITEM: ISOLATION VALVE 

FAILURE MODE: VALVE FAILS TO ISOLATE BAD SERVOVALVE CHANNEL 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 

BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) ELECTRO HYDRAULIC SERVOVALVE ASSEMBLY 

4) ISOLATION VALVE (4R, 4SB) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/3 

TAL: 

3/1R 

ONORBIT: 

3/3 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 




REDUNDANCY SCREENS: A[2] B[P] C[P] 

LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 

CAUSES: JAMMED SPOOL, CONTAMINATION, ELECTRICAL OPEN IN 

SOLENOID, LOSS OF SIGNAL FROM ASA. 

EFFECTS/RATIONALE : 

NONE. HVM IS DESIGNED WITH CAPABILITY OF 2 CHANNELS TO OVERRIDE 
FAILED UNISOLATED CHANNEL IN HARDOVER CONDITION. FULL CONTROL 
AUTHORITY IS MAINTAINED. 


REFERENCES : 


C-21 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

121 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

3/3 

3/3 


ITEM: RECIRCULATION VALVE (1R, 1SB) 

FAILURE MODE: FAILS OPEN, HYDRAULIC FLUID FLOWS AT ALL TIMES 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 

BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) RECIRCULATION VALVE (1R, 1SB) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 
LANDING/S AFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: JAMMED, CONTAMINATION 

EFFECTS/RATIONALE : 

NONE - NON-CRITICAL BACKUP. FLOW RESTRICTOR IN RETURN LINES WILL 
KEEP FLOW AT AN ACCEPTABLE LEVEL. 


REFERENCES 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

122 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: RECIRCULATION VALVE (1R, 1SB) 

FAILURE MODE: FAILS CLOSED, LOW OR NO HYDRAULIC FLOW 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 

BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATORS 

2) PDU (1) 

3) RECIRCULATION VALVE (1R, 1SB) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

LANDING/SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: JAMMED, CONTAMINATION, BORKEN SPRING, CLOGGED ORIFICE, 

CONTAMINATION 

EFFECTS/RATIONALE : 

NONE - NON-CRITICAL BACKUP. VALVE IS A SECOND BACKUP TO PDU 
HEATERS AND LINE HEATERS.” DE -ORBlT ' PREPARATION MOVfeS FLIGHT 
CONTROL SURFACES & CIRCULATES WARM FLUID THROUGH THE ACTUATORS. 


REFERENCES 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

123 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: TRIPLEX POWER VALVE 

FAILURE MODE: FAILS CLOSED/OPEN 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) ACT. MECH. RSB 

2) PDU (1) 

3) TRIPLEX POWER VALVE (1R, 1SB) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


C RITI CALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

3/3 

AOA: 

1/1 

DEORBIT: 
LANDING/S AFING: 

1/1 

3/3 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: SEIZED DUE TO THERMAL EFFECTS, CHIPS IN VALVE 


EFFECTS/RATIONALE : 

FAILS CLOSED. THERE IS A LOSS OF FLUID TO DRIVE THE MOTORS WHICH 
RESULTS IN LOSS OF FUNCTION. FAILS OPEN. SURFACES WILL DRIVE TO 
STOPS WHICH COULD CAUSE INTERNAL DAMAGE WITH SUBSEQUENT LOSS OF 
FUNCTION. 

EITHER FAILURE RESULTS IN LOSS OF VEHICLE CONTROL. 


REFERENCES : 


C-24 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

124 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

1/1 

1/1 


ITEM: HYDRAULIC MOTOR 

FAILURE MODE: MOTOR SHAFT WHICH PROVIDES TORQUE TO SUMMER 

DIFFERENTIAL OPEN. 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 

BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATOR 


2) 

PDU (1) 





3) 

HYDRAULIC MOTOR/BRAKE ASSEMBLY 

(3R, 

3SB) 


4) 

HYRAULIC MOTOR 





5) 






6) 






7) 






8) 






9) 








CRITICALITIES 




FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 


PRE LAUNCH: 

3/3 


RTLS: 

1/1 


LIFTOFF: 

3/3 


TAL: 

1/1 


ONORBIT: 

3/3 


AO A: 

1/1 


DEORBIT: 

1/1 


ATO: 

1/1 


LANDING/SAFING: 

3/3 




REDUNDANCY SCREENS: 

A [NA ] B 

[NA 

] 

C [NA ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: SHAFT SHEARED OR SPLINE SHEARED 

EFFECTS/RATIONALE : 

THIS IS A LOSS OF FUNCTION AND A LOSS OF CONTROL WHICH RESULTS IN 
LOSS OF VEHICLE/CREW. IF A SHAFT TO THE SUMMER DIFFERENTIAL IS 
FREE TO ROTATE, THE OTHER TWO MOTORS WILL DRIVE THE BAD SHAFT IN 
REVERSE, WHICH CAUSES A TORQUE SPILLOUT SO THAT THERE IS 
IS NO OUTPUT FROM THE GEARBOX TO THE MIXER GEARBOX. 

REFERENCES : 


C-25 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

125 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: HYDRAULIC MOTOR 

FAILURE MODE: DEGRADED MOTOR OUTPUT 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATOR 

2) PDU (1) 

3) HYDRAULIC MOTOR/BRAKE ASSEMBLY (3R, 3SB) 

4) HYRAULIC MOTOR 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/3 

TAL: 

3/1R 

ONORBIT: 

3/3 

AOA: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/ SAFING: 
REDUNDANCY SCREENS: 

3/3 

A [ 2 ] 

B [ F ] 

C [ P ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: INTERNAL FAILURE (BY-PASS LEAKAGE) 

EFFECTS/RATIONALE : 

LEAKAGE RESULTS IN DEGRADED CAPABILITY ONLY WITH SOME LOSS OF 
REDUNDANCY. THE SYSTEM WILL FUNCTION NORMALLY. A COMPLETE 
FAILURE OF A MOTOR LEAVES TWO ACTIVE MOTORS WHICH PROVIDE FULL 
CONTROL CAPABILITY. 


REFERENCES 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

10/16/86 

HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM: 

RSB 

FLIGHT: 

2/1R 

MDAC ID: 

126 

ABORT: 

2/1R 

ITEM: 

HYDRAULIC 

BRAKE 


FAILURE MODE: FAILS TO 

BRAKE (WITH LOSS OF HYDRAULIC 

PRESSURE) 

LEAD ANALYST: R. WILSON 

SUBSYS LEAD: R'. WILSON 



BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATOR 

2) PDU (1) 

3) HYDRAULIC MOTOR/BRAKE ASSEMBLY (3R, 3 SB) 

4) HYRAULIC BRAKE 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

3/3 

AOA: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/S AFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: FRACTURED ACTUATION-SPRING; PRESSURE PLATE, BRAKE PLATE, 

SHEARED BRAKE PLATE SPLINE. 

EFFECTS/RATIONALE : 

NONE (HYDRAULIC MOTOR STILL PROVIDES TORQUE TO DIFFERENTIAL GEAR 
BOX). SECOND FAILURE OR LOSS OF PRESSURE OF SAME SYSTEM CAUSES 
LOSS OF RSB. 


REFERENCES : 


C-27 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATES 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

127 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

3/1R 

3/1R 


ITEM: HYDRAULIC BRAKE 

FAILURE MODE: FAILS TO RELEASE 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATOR 

2) PDU (1) 

3) HYDRAULIC MOTOR/BRAKE ASSEMBLY (3R, 3SB) 

4) HYRAULIC BRAKE 

5) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/3 

TAL: 

3/1R 

ONORBIT: 

3/3 

AO A: 

3/1R 

DEORBIT: 
LANDING/S AFING: 

3/1R 

3/3 

ATO: 

3/1R 

REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: INTERNAL BY-PASS LEAK FAST PISTON TO RETURN, STUCK 

BRAKE, BLOCKED PRESSURE 

EFFECTS/RATIONALE : 

LOSS OF 1 SYSTEM. ONE MOTOR OUT - FULL RATE; 2 MOTORS OUT HALF 
RATE. 


REFERENCES : 


C-28 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 10/16/86 

SUBSYSTEM: RSB 

MDAC ID: 128 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: HYDRAULIC BRAKE 

FAILURE MODE: OPEN 


LEAD ANALYST: R. WILSON 


SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATOR 

2) PDU (1) 

3) HYDRAULIC MOTOR/BRAKE ASSEMBLY (3R, 3SB) 

4) HYRAULIC BRAKE 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

3/3 

AOA: 

1/1 

DEORBIT: 

1/1 

ATO: 

1/1 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: INTERNAL SPLINE OR SHAFT SHEARED 


EFFECTS/RATIONALE : 

LOSS OF RSB. (BRAKE IS SET ONLY IF HYDRAULIC PRESSURE IS LOST.) 
SHEARED SPLINE OR SHAFT - NO RPM/TORQUE TO DIFFERENTIAL GEARBOX. 
DIFFERENTIAL BACK DRIVES - NO OUTPUT TO MIXER GEAR BOX. NOTE: IF 
A HYD. FAILURE OCCURRED & THE MOTOR DRIVESHAFT WAS 
FREE TO ROTATE, THE ACTION OF THE OTHER 2 GOOD MOTORS THROUGH THE 
DIFFERENTIAL GEARBOX WOULD DRIVE THE BAD ONE IN REVERSE^ IT WOULD 
TRY TO ACT LIKE A HYD. PUMP AND THIS IN TURN WOULD TRANSMIT AN 
OPPOSITE TORQUE INTO THE GEARBOX. 


REFERENCES : 


C-29 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

129 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: SUMMER DIFFERENTIAL GEARBOX 

FAILURE MODE: OPEN - NO RPM/TORQUE OUTPUT 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATOR 

2) PDU (1) 

3) SUMMER DIFFERENTIAL GEARBOX (1R, 

4) 

5) 

6 ) 

7) 

8) 

9) 


1SB) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

3/3 

AO A: 

1/1 

DEORBIT: 
LANDING/S AFING: 

1/1 

3/3 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: ONE OF THREE SPLINED SHAFTS DISENGAGES, SPLINE OR GEAR 

FAILURE 


EFFECTS/RATIONALE : 

GEARBOX SUMS 3 MOTOR TORQUES TO SINGLE OUTPUT SHAFT TO DRIVE 
MIXER GEARBOX. LOSS OF OUTPUT - LOSS OF CONTROL. 


REFERENCES : 


C-30 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 10/16/86 

SUBSYSTEM: RSB 

MDAC ID: 130 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: SUMMER DIFFERENTIAL GEARBOX 

FAILURE MODE: DIFFERENTIAL OUTPUT JAM 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATOR 

2) PDU (1) 

3) SUMMER DIFFERENTIAL GEARBOX (1R, 1SB) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

3/3 

AOA: 

1/1 

DEORBIT: 

1/1 

ATO: 

1/1 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: GEAR MESH JAMMED BY BROKEN TOOTH, SEIZED BEARING 

EFFECTS/RATIONALE : 

LOSS OF OUTPUT TO MIXER - LOSS OF CONTROL. 


REFERENCES : 


C-31 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 10/16/86 

SUBSYSTEM: RSB 

MDAC ID: 131 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: SUMMER DIFFERENTIAL GEARBOX 

FAILURE MODE: REDUCED TORQUE OUTPUT 


LEAD ANALYST:. R. WILSON 


SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATOR 

2) PDU (1) 

3) SUMMER DIFFERENTIAL GEARBOX (1R, 1SB) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

■ 

PRE LAUNCH: 

3/3 

RTLS: 

2/1R 


LIFTOFF: 

3/3 

TAL: 

2/1R 



ONORBIT: 

3/3 

AOA: 

2/1R 


DEORBIT: 

2/1R 

ATO: 

2/1R 


LANDING/SAFING: 

3/3 


■ 

— 

REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 

m 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 

CAUSES: JAM ONE SET OF GEARS OF ONE DIFFERENTIAL 

EFFECTS/RATIONALE : 

JAMS 2 MOTORS - 1 MOTOR PROVIDE OUTPUT AT 1/2 RATE. LOSS OF 
OTHER MOTOR - CAUSE LOSS OF RSB CONTROL. 


REFERENCES : 


C-32 


ill „ij 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

132 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: SUMMER DIFFERENTIAL GEARBOX 

FAILURE MODE: JAMMED - 1 INPUT SHAFT 


LEAD ANALYST: R. WILSON 


SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 


' — ; 

1) 

RSB SERVO ACTUATOR 

— 

2) 

PDU (1) 


3) 

SUMMER DIFFERENTIAL 


4) 


mm 

5) 



6) 



7) 



8) 



9) 



GEARBOX 


(1R, 


1SB) 


CRITICALITIES 



FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 


PRELAUNCH: 

3/3 

RTLS: 

3/1R 

= : 

LIFTOFF: 

3/3 

TAL: 

3/1R 

» — j 

ONORBIT: 

3/3 

AO A: 

3/1R 


DEORBIT: 

2/1R 

ATO: 

3/1R 


LANDING/ SAFING: 

3/3 




REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC62 1-0053-0048 


CAUSES: GEAR MESH JAMMED SEIZED BEARING 

EFFECTS/RATIONALE : 

NONE - 2 MOTORS DRIVE AT FULL RATE. 2ND FAILURE/MOTOR DRIVE AT 
1/2 RATE. 




REFERENCES : 


C-33 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

133 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: POSITION TRANSDUCER 

FAILURE MODE: LOSS OF OUTPUT (ALL TRANSDUCERS) 


LEAD ANALYST: R. WILSON SUBSYS LEAD: R. WILSON 

BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATOR 


2) 

PDU (1) 




3) 

SUMMER DIFFERENTIAL GEARBOX 

(1R, 1SB) 


4) 





5) 





6) 





7) 





8) 





9) 







CRITICALITIES 



FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 


PRELAUNCH: 

3/3 

RTLS: 

1/1 


LIFTOFF: 

3/3 

TAL: 

1/1 


ONORBIT: 

3/3 

AOA: 

1/1 


DEORBIT: 

1/1 

ATO: 

1/1 


LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: SHEARED SHAFT; DRIVE TRAIN FAILURE (GEAR SHAFT TO X- 

DUCER SHAFT) 

EFFECTS/RATIONALE : 

LOSS OF INPUT TO ASA'S. LOSS OF RSB CONTROL. NOTE: RESULT OF 102 
TEARDOWN-RI FOUND THAT AN INTERNAL BOLT WHICH HOLDS THE ASSY 
TOGETHER, HAD A LOCK WASHER WITH TAB THAT PEEPS BOLT FROM BACKING 
OFF HAD A CRACK* 

(IF TAB FELL OFF COULD JAM X-DUCER (1/1 CRIT) . RI (SUNSTRAND) HAS 
GONE TO ERB PROPOSING A FIX-WILL PRESENT A NASA CCB FOR GO-AHEAD 
APPROVAL. 


REFERENCES 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

134 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


HDW/FUNC 

2/1R 

2/1R 


ITEM: POSITION TRANSDUCER 

FAILURE MODE: LOSS OR ERRONEOUS OUTPUT (ONE OF FOUR OUTPUTS) 


LEAD ANALYST: R. WILSON 


SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATOR 

2) PDU (1) 

3) SUMMER DIFFERENTIAL GEARBOX (1R, 1SB) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

3/3 

AOA: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P ] 

C [ P ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: OPEN COIL, LEAD, FAULTY X-DUCER, DRIFT, ELECTRICAL 

SHORT, OPEN IN ASA. 

EFFECTS/RATIONALE : 

NONE - FAILURE MODE IS 3/1R. 2 ASA FAILURES CAN REULT IN LOSS OF 

CREW/ VEHICLE IF UNDETECTED. ASA FAILURE MODE IS 2/1R. 


REFERENCES : 


C-35 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

135 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: MIXER GEARBOX (1) 

FAILURE MODE: NO OUTPUT, BOTH SHAFTS 


LEAD ANALYST: R. WILSON 


SUBSYS LEAD: R. WILSON 


BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATOR 

2) PDU (1) 

3) MIXER GEARBOX (1) 

4) 

5) 

6 ) 

7) 

8 ) 

8 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

•3/3 

AO A: 

1/1 

DEORBIT: 
LANDING/S AFING: 

1/1 

3/3 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: OPEN/ JAMMED ONE/BOTH SHAFTS, GEAR FRACTURE PARTS LODGED 

IN GEAR MESH, SEIZED BEARINGS 


EFFECTS/RATIONALE : 

LOSS OF RSB FUNCTIONS. 


REFERENCES : 


C-36 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

10/16/86 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

RSB 

FLIGHT: 

1/1 

MDAC ID: 

136 

ABORT: 

1/1 

ITEM: 

GEAR ROTARY 

ACTUATOR (4) 


FAILURE MODE 

: JAMMED 



LEAD ANALYST: R. WILSON 

SUBSYS LEAD: R. WILSON 



BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATOR 

2) GEAR ROTARY ACTUATOR (4) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

i/i 

LIFTOFF: 

3/3 

TAL: 

i/i 

ONORBIT: 

3/3 

AO A: 

i/i 

DEORBIT: 

1/1 

ATO: 

i/i 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] B 

[NA ] 

C [NA ] 

LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0049, 0040, 

0041, 0042 



CAUSES: BROKEN TEETH, PART LODGED IN GEAR MESH, SEIZED BEARINGS, 

CONTAMINATION LOSS OF LUBRICANT MATERIAL DEFECT, MANUFACTURING 
DEFECT, FRACTURED SHAFT (FATIGUE, OVERLOAD) 

EFFECTS/RATIONALE : 

LOSS OF FUNCTION. LOSS OF RSB. LOSS OF CONTROL. 


REFERENCES : 


C-37 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

10/16/86 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

RSB 

FLIGHT: 

1/1 

MDAC ID: 

137 

ABORT: 

1/1 

ITEM: 

DRIVE SHAFTS 



FAILURE MODE 

!: OPEN, NO POWER 

TRANSMISSION 


LEAD ANALYST 

': R. WILSON 

SUBSYS LEAD: R. WILSON 



BREAKDOWN HIERARCHY: 

1) RSB SERVO ACTUATOR 

2) DRIVE SHAFTS (10) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

3/3 

AOA: 

1/1 

DEORBIT: 

LANDING/SAFING: 

1/1 

3/3 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC6 21-0053 


CAUSES: ALL TEETH SHEARED ON SPLINE, SHEARED BOLT, SHEARED 

RIVETS, SHEARED SHAFT 

EFFECTS/RATIONALE : 

TRANSFERS RPM/TORQUE BETWEEN PDU AND ROTARY ACTUATORS AND BETWEEN 
ROTARY ACTUATORS. LOSS OF FUNCTION. LOSS OF CONTROL. 


REFERENCES : 


C-38 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
1/1 
1/1 


BREAKDOWN HIERARCHY: 

1) RUDDER/SPEEDBRAKE SERVO ACTUATOR 

2) POWER DRIVE UNIT 

3) DIFFERENTIAL GEAR BOX 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 

RSB 

138 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: DIFFERENTIAL GEAR BOX 

FAILURE MODE: INPUT SHAFT FROM 1ST DIFFERENTIAL TO 2ND 

DIFFERENTIAL OPEN 


LEAD ANALYST: R. WILSON 


SUBSYS LEAD: R. WILSON 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

3/3 

AO A: 

1/1 

DEORBIT: 
LANDING/ SAFING: 

1/1 

3/3 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: VERTICAL STABILIZER 

PART NUMBER: MC621-0053-0048 


CAUSES: SPLINED SHAFT DISENGAGES, SPLINE OR GEAR FRACTURE 

EFFECTS/RATIONALE : 

LOSS OF CONTROL. LOSS OF VEHICLE/CREW . 2ND DIFFERENTIAL 
BACKDRIVES FROM ONE REMAINING INPUT SINCE THERE IS NO RESTRAINING 
TORQUE. NO OUTPUT FROM DIFFERENTIAL TO MIXER GEARBOX. 


REFERENCES : 


C-39 





APPENDIX D 

POTENTIAL CRITICAL ITEMS 


MDAC-ID 

ITEM 

FAILURE MODE 

101 

PDU 

Gross fluid loss, 3 systems 

102 

PDU 

Gross fluid loss, 1 system 

103 

PDU 

Internal leak 

105 

Filter 

Clogged 

110 

Switching Valve 

Secondary spool fails to switch 

111 

Switch Valve 

Primary spool fails to switch 

114 

Servovalve 

Fails at null 

115 

Servovalve 

Fails to return to null 

116 

Servovalve 

No or erroneous output 

117 

Torque Motor Assembly 

Motor fails, open/short, loss 
of signal 

118 

Torque Motor Assembly 

Flapper broken 

119 

Secondary delta-P 

Loss of or erroneous output 


Transducer 

(1 of 4) 

123 

Power Valve 

Fails open/closed 

124 

Hydraulic Motor 

Open 

126 

Hydraulic Brake 

Fails to brake 

127 

Hydraulic Brake 

Fails to release 

128 

Hydraulic Brake 

Open 

129 

Summer Differential 

Open 

130 

Summer Differential 

Output jammed 

131 

Summer Differential 

Partial jam 

132 

Summer Differential 

Jam, 1 input shaft 

133 

Position Transducer 

Fail all 4 

134 

Position Transducer 

Loss of erroneous output 
(1 of 4) 

135 

Mixer Gearbox 

Open; jammed 

136 

Drive Shaft 

Open 

137 

Rotary Actuator 

Jammed 

138 

Summer Differential 

First differential shaft-open 


D-l 



